The vulnerability is an incorrect permission assignment that allows a local user to write to a critical directory used by the MOVEit Transfer service. By doing so, the attacker can alter or replace service binaries or configuration files, enabling execution with elevated privileges. The flaw is categorized as CWE‑732.

Progress: MOVEit Transfer. Versions before 2025.1.6 and the series from 2026.0.0 up to (but not including) 2026.0.4 are affected.

The vulnerability has a CVSS score of 8.8, indicating high severity. The EPSS score is < 1%, implying a very low probability of exploitation. The vulnerability is not listed in CISA KEV, suggesting current public exploitation is not confirmed. The attack vector is inferred to be local; an authenticated local user must have access to the compromised system to write to the vulnerable directory. Once write access is achieved, the attacker can elevate their privileges to the level under which the MOVEit Transfer service operates.